phobos | 104032d8993555a84679746069ad1f8c1365c4a27eaeec732fda76aa62da005a

General

Target

8581a33bb410c7674705ca163c6f75ad.exe
Size

271KB
MD5

8581a33bb410c7674705ca163c6f75ad
SHA1

3dd6bb5a8786eb073a6f7d26454a8ddbffbbe48f
SHA256

104032d8993555a84679746069ad1f8c1365c4a27eaeec732fda76aa62da005a
SHA512

4519a93e98b555a4eac8c18cb61bd28c862d47d6036362f9776074ae897e621202ad80d28f83686bfe3d185081ebd19ac951183768851f3bf17a403c73624302
SSDEEP

6144:ymJUPTQVx/LACZmikqYGlJfOuwOFZ/QlUvt0NFQp/TDOkUFahk99:v6cLA0cqYd0FxQlU0Nup/TDOkUFahk9

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>0407854A-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message 0407854A-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

220 bcdedit.exe
236 bcdedit.exe
1332 bcdedit.exe
1116 bcdedit.exe
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

2924 wbadmin.exe
2400 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

2672 netsh.exe
1788 netsh.exe

pid	process
220	bcdedit.exe
236	bcdedit.exe
1332	bcdedit.exe
1116	bcdedit.exe

pid	process
2924	wbadmin.exe
2400	wbadmin.exe

pid	process
2672	netsh.exe
1788	netsh.exe

Drops startup file 3 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8581a33bb410c7674705ca163c6f75ad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8581a33bb410c7674705ca163c6f75ad = "C:\\Users\\Admin\\AppData\\Local\\8581a33bb410c7674705ca163c6f75ad.exe"	8581a33bb410c7674705ca163c6f75ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\8581a33bb410c7674705ca163c6f75ad = "C:\\Users\\Admin\\AppData\\Local\\8581a33bb410c7674705ca163c6f75ad.exe"	8581a33bb410c7674705ca163c6f75ad.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WYZEMTEU\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1DRFDKCL\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HJMUORIZ\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RIT0VQ4M\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3750544865-3773649541-1858556521-1000\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JQALZ7NY\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDLDGKZQ\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z0TR3CUC\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	8581a33bb410c7674705ca163c6f75ad.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe8581a33bb410c7674705ca163c6f75ad.exe

description	pid	process	target process
PID 2152 set thread context of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 set thread context of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe

Drops file in Program Files directory 64 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\psmachine_64.dll.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXC	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mset7es.kic	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\pdmproxy100.dll	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\SEQCHK10.DLL.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\background.gif.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\TYPE.WAV.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48F.GIF.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULQOT98.POC	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ro.dll	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR35F.GIF	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDBAR98.POC	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\Windows Sidebar\ja-JP\sbdrop.dll.mui	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239943.WMF	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_uk.dll.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153265.WMF	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH.HXS.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC	8581a33bb410c7674705ca163c6f75ad.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx.id[0407854A-3483].[[email protected]].8base	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png	8581a33bb410c7674705ca163c6f75ad.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo	8581a33bb410c7674705ca163c6f75ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

2544 vssadmin.exe
2192 vssadmin.exe

pid	process
2544	vssadmin.exe
2192	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe

pid	process
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe
2092	8581a33bb410c7674705ca163c6f75ad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe8581a33bb410c7674705ca163c6f75ad.exe8581a33bb410c7674705ca163c6f75ad.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2152	8581a33bb410c7674705ca163c6f75ad.exe
Token: SeDebugPrivilege	2076	8581a33bb410c7674705ca163c6f75ad.exe
Token: SeDebugPrivilege	2092	8581a33bb410c7674705ca163c6f75ad.exe
Token: SeBackupPrivilege	2552	vssvc.exe
Token: SeRestorePrivilege	2552	vssvc.exe
Token: SeAuditPrivilege	2552	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1812	WMIC.exe
Token: SeSecurityPrivilege	1812	WMIC.exe
Token: SeTakeOwnershipPrivilege	1812	WMIC.exe
Token: SeLoadDriverPrivilege	1812	WMIC.exe
Token: SeSystemProfilePrivilege	1812	WMIC.exe
Token: SeSystemtimePrivilege	1812	WMIC.exe
Token: SeProfSingleProcessPrivilege	1812	WMIC.exe
Token: SeIncBasePriorityPrivilege	1812	WMIC.exe
Token: SeCreatePagefilePrivilege	1812	WMIC.exe
Token: SeBackupPrivilege	1812	WMIC.exe
Token: SeRestorePrivilege	1812	WMIC.exe
Token: SeShutdownPrivilege	1812	WMIC.exe
Token: SeDebugPrivilege	1812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1812	WMIC.exe
Token: SeRemoteShutdownPrivilege	1812	WMIC.exe
Token: SeUndockPrivilege	1812	WMIC.exe
Token: SeManageVolumePrivilege	1812	WMIC.exe
Token: 33	1812	WMIC.exe
Token: 34	1812	WMIC.exe
Token: 35	1812	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1812	WMIC.exe
Token: SeSecurityPrivilege	1812	WMIC.exe
Token: SeTakeOwnershipPrivilege	1812	WMIC.exe
Token: SeLoadDriverPrivilege	1812	WMIC.exe
Token: SeSystemProfilePrivilege	1812	WMIC.exe
Token: SeSystemtimePrivilege	1812	WMIC.exe
Token: SeProfSingleProcessPrivilege	1812	WMIC.exe
Token: SeIncBasePriorityPrivilege	1812	WMIC.exe
Token: SeCreatePagefilePrivilege	1812	WMIC.exe
Token: SeBackupPrivilege	1812	WMIC.exe
Token: SeRestorePrivilege	1812	WMIC.exe
Token: SeShutdownPrivilege	1812	WMIC.exe
Token: SeDebugPrivilege	1812	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1812	WMIC.exe
Token: SeRemoteShutdownPrivilege	1812	WMIC.exe
Token: SeUndockPrivilege	1812	WMIC.exe
Token: SeManageVolumePrivilege	1812	WMIC.exe
Token: 33	1812	WMIC.exe
Token: 34	1812	WMIC.exe
Token: 35	1812	WMIC.exe
Token: SeBackupPrivilege	772	wbengine.exe
Token: SeRestorePrivilege	772	wbengine.exe
Token: SeSecurityPrivilege	772	wbengine.exe
Token: SeIncreaseQuotaPrivilege	2432	WMIC.exe
Token: SeSecurityPrivilege	2432	WMIC.exe
Token: SeTakeOwnershipPrivilege	2432	WMIC.exe
Token: SeLoadDriverPrivilege	2432	WMIC.exe
Token: SeSystemProfilePrivilege	2432	WMIC.exe
Token: SeSystemtimePrivilege	2432	WMIC.exe
Token: SeProfSingleProcessPrivilege	2432	WMIC.exe
Token: SeIncBasePriorityPrivilege	2432	WMIC.exe
Token: SeCreatePagefilePrivilege	2432	WMIC.exe
Token: SeBackupPrivilege	2432	WMIC.exe
Token: SeRestorePrivilege	2432	WMIC.exe
Token: SeShutdownPrivilege	2432	WMIC.exe
Token: SeDebugPrivilege	2432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2432	WMIC.exe
Token: SeRemoteShutdownPrivilege	2432	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8581a33bb410c7674705ca163c6f75ad.exe8581a33bb410c7674705ca163c6f75ad.exe8581a33bb410c7674705ca163c6f75ad.execmd.execmd.exe

description	pid	process	target process
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2152 wrote to memory of 2092	2152	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2076 wrote to memory of 2252	2076	8581a33bb410c7674705ca163c6f75ad.exe	8581a33bb410c7674705ca163c6f75ad.exe
PID 2092 wrote to memory of 2420	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2420	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2420	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2420	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2696	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2696	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2696	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2092 wrote to memory of 2696	2092	8581a33bb410c7674705ca163c6f75ad.exe	cmd.exe
PID 2696 wrote to memory of 2672	2696	cmd.exe	netsh.exe
PID 2696 wrote to memory of 2672	2696	cmd.exe	netsh.exe
PID 2696 wrote to memory of 2672	2696	cmd.exe	netsh.exe
PID 2420 wrote to memory of 2544	2420	cmd.exe	vssadmin.exe
PID 2420 wrote to memory of 2544	2420	cmd.exe	vssadmin.exe
PID 2420 wrote to memory of 2544	2420	cmd.exe	vssadmin.exe
PID 2696 wrote to memory of 1788	2696	cmd.exe	netsh.exe
PID 2696 wrote to memory of 1788	2696	cmd.exe	netsh.exe
PID 2696 wrote to memory of 1788	2696	cmd.exe	netsh.exe
PID 2420 wrote to memory of 1812	2420	cmd.exe	WMIC.exe
PID 2420 wrote to memory of 1812	2420	cmd.exe	WMIC.exe
PID 2420 wrote to memory of 1812	2420	cmd.exe	WMIC.exe
PID 2420 wrote to memory of 220	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 220	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 220	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 236	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 236	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 236	2420	cmd.exe	bcdedit.exe
PID 2420 wrote to memory of 2924	2420	cmd.exe	wbadmin.exe
PID 2420 wrote to memory of 2924	2420	cmd.exe	wbadmin.exe
PID 2420 wrote to memory of 2924	2420	cmd.exe	wbadmin.exe
PID 2092 wrote to memory of 2720	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2720	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2720	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2720	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2496	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2496	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2496	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2496	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2964	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2964	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2964	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2964	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe
PID 2092 wrote to memory of 2028	2092	8581a33bb410c7674705ca163c6f75ad.exe	mshta.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
"C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152

C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
"C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
C:\Users\Admin\AppData\Local\Temp\8581a33bb410c7674705ca163c6f75ad.exe
4⤵
PID:2252

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2544

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:220

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:236

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2924

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:2672

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:1788

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2720

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2496

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2964

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
3⤵
- Modifies Internet Explorer settings
PID:2028

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:2240

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:2192

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1332

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1116

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:2400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:976

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

3

T1070

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[0407854A-3483].[[email protected]].8base
Filesize
143.1MB

MD5
7060025d29e87f9228616807e4f56fbf

SHA1
68a91f682794ed2c36bc5e08ec909770f6ed056b

SHA256
3b1a2f2d3d0e7a0eb3e35012ff5405dece1a88878b1cad3fd94f28e52afd27e6

SHA512
5e9e166b7e1dd912ef31615bf1eea3fd107030e171b13056eb91a3edac5f37323f2c3d2d4c114c220400fece91dbe1b96d4da04447b7dcfa6032bcbcadcf3dd5

Download Submit
C:\Users\Admin\Desktop\info.hta
Filesize
5KB

MD5
088e93e3f57863e4be055b3609e8eeed

SHA1
94c677fd05b4082368bab84b64aed545b4bce695

SHA256
df4d6abef4d7375041038fa3ea4b876b0e25a4b13511b93134154aad990a4273

SHA512
887a245cc07f157bce37ecff40201523c70033549b67e4d007e2e4f1933826d3b39f22bdf84669dfd08fb4e10f95e1d39bca7a83535239b50bd938665f92a396

Download Submit
C:\info.hta
Filesize
5KB

MD5
088e93e3f57863e4be055b3609e8eeed

SHA1
94c677fd05b4082368bab84b64aed545b4bce695

SHA256
df4d6abef4d7375041038fa3ea4b876b0e25a4b13511b93134154aad990a4273

SHA512
887a245cc07f157bce37ecff40201523c70033549b67e4d007e2e4f1933826d3b39f22bdf84669dfd08fb4e10f95e1d39bca7a83535239b50bd938665f92a396

Download Submit
C:\info.hta
Filesize
5KB

MD5
088e93e3f57863e4be055b3609e8eeed

SHA1
94c677fd05b4082368bab84b64aed545b4bce695

SHA256
df4d6abef4d7375041038fa3ea4b876b0e25a4b13511b93134154aad990a4273

SHA512
887a245cc07f157bce37ecff40201523c70033549b67e4d007e2e4f1933826d3b39f22bdf84669dfd08fb4e10f95e1d39bca7a83535239b50bd938665f92a396

Download Submit
C:\users\public\desktop\info.hta
Filesize
5KB

MD5
088e93e3f57863e4be055b3609e8eeed

SHA1
94c677fd05b4082368bab84b64aed545b4bce695

SHA256
df4d6abef4d7375041038fa3ea4b876b0e25a4b13511b93134154aad990a4273

SHA512
887a245cc07f157bce37ecff40201523c70033549b67e4d007e2e4f1933826d3b39f22bdf84669dfd08fb4e10f95e1d39bca7a83535239b50bd938665f92a396

Download Submit
F:\info.hta
Filesize
5KB

MD5
088e93e3f57863e4be055b3609e8eeed

SHA1
94c677fd05b4082368bab84b64aed545b4bce695

SHA256
df4d6abef4d7375041038fa3ea4b876b0e25a4b13511b93134154aad990a4273

SHA512
887a245cc07f157bce37ecff40201523c70033549b67e4d007e2e4f1933826d3b39f22bdf84669dfd08fb4e10f95e1d39bca7a83535239b50bd938665f92a396

Download Submit
memory/2076-35-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-20-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2076-22-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2076-21-0x00000000004A0000-0x00000000004E6000-memory.dmp

Filesize
280KB

Download
memory/2076-19-0x0000000000BA0000-0x0000000000BEA000-memory.dmp

Filesize
296KB

Download
memory/2092-51-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-91-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-52-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-11-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-8-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-3823-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-3683-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-325-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-47-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-49-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-50-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-302-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-65-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-78-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-79-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-53-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2092-111-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2152-16-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/2152-0-0x0000000000BA0000-0x0000000000BEA000-memory.dmp

Filesize
296KB

Download
memory/2152-5-0x0000000000AD0000-0x0000000000B1C000-memory.dmp

Filesize
304KB

Download
memory/2152-4-0x0000000000710000-0x0000000000744000-memory.dmp

Filesize
208KB

Download
memory/2152-3-0x0000000000550000-0x0000000000590000-memory.dmp

Filesize
256KB

Download
memory/2152-2-0x0000000000690000-0x00000000006D6000-memory.dmp

Filesize
280KB

Download
memory/2152-1-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/2252-39-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2252-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads